VoidStealer Propose Change

According to Gen Threat Labs, VoidStealer is a Malware-as-a-Service infostealer that targets browser credentials and is the first observed malware in the wild to employ a novel debugger-based Application-Bound Encryption bypass technique. It attaches to the browser process as a debugger and sets hardware breakpoints at specific code locations to extract the v20_master_key directly from browser memory during startup, without requiring privilege escalation or code injection. The technique is adapted from the open-source ElevationKatz project and specifically targets Chromium-based browsers such as Chrome and Edge. As a fallback, VoidStealer also implements a traditional process injection method to invoke the browser's internal decryption interface when the debugger approach is unavailable.

References

There is no Yara-Signature yet.